Support for Wavlink WL-WN530HG4-B

wrtwf · December 5, 2024, 5:02pm

Hi!

I obtained this router via Amazon, thinking it would be an easy flash (ToH listed, duh!). Unfortunately the inevitable happened and I received the very much incompatible Revision B. Upon closer inspection, I should have been able to tell by the obvious differences from the product pictures (2x GBit LAN instead of 4x FE), but here we are now.

Is there any chance to get this to work? Since the initial variant was pretty much a clone of the Phicomm K2G, I assumed it would be the same story for the new version, but I coudn't find a matching Phicomm device with only 2 LAN ports.

I opened the case to check if the SoC stayed the same, but the (now much more compact) RF shielding pretty much seems to be soldered all the way around the edges. I also could not manage to get a serial log from conveniently labelled UART port, both 57600 and 115200 8N1 only seem so spill garbage on my console.

Shot of the PCB:

Thanks!

evs · December 5, 2024, 10:16pm

I'd try all the other standard serial baud rates? Or get a logic analyser?

Other times it's my cheap serial adapters and I end up using a hardware serial portt with an adapter.

Without removing the can, getting serial port working, or finding someone else's teardown pictures it would be difficult.

Only other thing I can think of is do you have a way to get a root shell on the factory firmware?

But in any case, serial port is pretty much essential to port openwrt IMO =P

wrtwf · January 1, 2025, 11:16am

Happy new year!

I was able to obtain the bootlog now, using a cheap dedicated USB serial converter. Leassons learned:

Don't use a Raspi for everything! Even though it works fine with other devices (e.g. ESP32 boards), I still cannot get it to work in this case.
The device already seems to be running some sort of OpenWRT base, as stated on several occasions, which is the usual obvious GPL violation.
Serial speed switched to 115200 8N1 with this revision
If I interpreted the output correctly, the SoC changed to a SiFlower SF19A28. This is pretty bad news, all I could find was this commit: https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=4ed209326b5299584ad22b82d0f5ba0d12ceb169

Here is the bootlog for futher reference:

Booting...
IROM DONE!
SiFlower SFAX8 Bootloader (Aug 28 2024 - 02:53:28)-Winstar
ddr2 m14d5121632a init start 400mhz
MEM_PHY_CLK_DIV = 0x3
DDR training success
now ddr frequency is 400MHz!!!
ddr test
DR1BW a0000000 OK
DR1BR OK
DR2BW a0000000 OK
DR2BR OK
DR4BW a0000000 OK
DR4BR OK
DR8BW a0000000 OK
DR8BR OK
Boot from spi-flash
U-image: U-Boot 2016.07-rc2-00014-compre, size is 104733
loaded - jumping to U-Boot 0xa0000000...


U-Boot 2016.07-rc2 (Aug 28 2024 - 02:53:35 +0000)

Board: MIPS sfa18 A28 MPW0 p20b
       Watchdog enabled
DRAM:  64 MiB
SF: Detected fm25q64 with page size 256 Bytes, erase size 4 KiB, total 8 MiB
In:    serial@8300000
Out:   serial@8300000
Err:   serial@8300000
Net:   Registering sfa18 gmac
read version 0x1037
1051 chid_id 0xc0ff0410
SF: Detected fm25q64 with page size 256 Bytes, erase size 4 KiB, total 8 MiB
get gmac delay:2a08
get gmac delay:0x2a08
sf_eth1
Warning: sf_eth1 (eth0) using random MAC address - d2:c0:0a:7b:ee:5a

Hit any key to stop autoboot:  0 
do_spi_flash----cmd = probe
SF: Detected fm25q64 with page size 256 Bytes, erase size 4 KiB, total 8 MiB
do_spi_flash----cmd = read
device 0 offset 0xa0000, size 0x700000
SF: 7340032 bytes @ 0xa0000 Read: OK
## Booting kernel from Legacy Image at 81000000 ...
   Image Name:   MIPS OpenWrt Linux-4.14.90
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1980195 Bytes = 1.9 MiB
   Load Address: 80100000
   Entry Point:  805757a0
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
All resets are held!
[    0.000000] Linux version 4.14.90 (zhangyizhi@soft_app) (gcc version 7.4.0 (OpenWrt GCC 7.4.0 r0-c38954c37)) #113 SMP Tue Aug 6 18:01:08 CST 2024
[    0.000000] memsize not set in YAMON, set to default (256MB)
[    0.000000] arcs_cmdline=mem=64M
[    0.000000] CPU0 revision is: 5301a128 (MIPS interAptiv (multi))
[    0.000000] FPU revision is: 0173a000
[    0.000000] MIPS: machine is sf19a28-ac28s
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 01f00000 @ 00000000 (usable)
[    0.000000]  memory: 000c0000 @ 01f00000 (reserved)
[    0.000000]  memory: 02040000 @ 01fc0000 (usable)
[    0.000000] User-defined physical RAM map:
[    0.000000]  memory: 01f00000 @ 00000000 (usable)
[    0.000000]  memory: 000c0000 @ 01f00000 (reserved)
[    0.000000]  memory: 02040000 @ 01fc0000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] VPE topology {2,2} total 4
[    0.000000] Primary instruction cache 16kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 16kB, 4-way, VIPT, no aliases, linesize 32 bytes
[    0.000000] MIPS secondary cache 128kB, 8-way, linesize 32 bytes.
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] random: get_random_bytes called from start_kernel+0x8c/0x4a8 with crng_init=0
[    0.000000] percpu: Embedded 15 pages/cpu @81098000 s29504 r8192 d23744 u61440
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 16256
[    0.000000] Kernel command line: mem=64M rdinit=/sbin/init rootfstype=squashfs,jffs2 console=ttyS0,115200n8
[    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 56312K/65536K available (4600K kernel code, 195K rwdata, 1144K rodata, 324K init, 217K bss, 9224K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[    0.000000] Hierarchical RCU implementation.
[    0.000000]  RCU event tracing is enabled.
[    0.000000] NR_IRQS: 128
[    0.000000] EIC is off
[    0.000000] VINT is on
[    0.000000] using 40MHz osc clk now!
[    0.000000] clocksource: GIC: mask: 0xffffffffffffffff max_cycles: 0xb881274fa3, max_idle_ns: 440795210636 ns
[    0.000000] clocksource: timer: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604467 ns
[    0.000014] sched_clock: 32 bits at 100MHz, resolution 10ns, wraps every 21474836475ns
[    0.000295] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 4778151116 ns
[    0.000383] Calibrating delay loop... 531.66 BogoMIPS (lpj=2658304)
[    0.059973] pid_max: default: 32768 minimum: 301
[    0.060211] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.060233] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.062845] Hierarchical SRCU implementation.
[    0.064043] smp: Bringing up secondary CPUs ...
[    0.064965] Primary instruction cache 16kB, VIPT, 4-way, linesize 32 bytes.
[    0.064981] Primary data cache 16kB, 4-way, VIPT, no aliases, linesize 32 bytes
[    0.064996] MIPS secondary cache 128kB, 8-way, linesize 32 bytes.
[    0.065157] CPU1 revision is: 5301a128 (MIPS interAptiv (multi))
[    0.065164] FPU revision is: 0173a000
[    0.120238] Synchronize counters for CPU 1: done.
[    0.122526] Primary instruction cache 16kB, VIPT, 4-way, linesize 32 bytes.
[    0.122545] Primary data cache 16kB, 4-way, VIPT, no aliases, linesize 32 bytes
[    0.122560] MIPS secondary cache 128kB, 8-way, linesize 32 bytes.
[    0.122702] CPU2 revision is: 5301a128 (MIPS interAptiv (multi))
[    0.122708] FPU revision is: 0173a000
[    0.181777] Synchronize counters for CPU 2: done.
[    0.183114] Primary instruction cache 16kB, VIPT, 4-way, linesize 32 bytes.
[    0.183132] Primary data cache 16kB, 4-way, VIPT, no aliases, linesize 32 bytes
[    0.183146] MIPS secondary cache 128kB, 8-way, linesize 32 bytes.
[    0.183301] CPU3 revision is: 5301a128 (MIPS interAptiv (multi))
[    0.183307] FPU revision is: 0173a000
[    0.241909] Synchronize counters for CPU 3: done.
[    0.242209] smp: Brought up 1 node, 4 CPUs
[    0.251163] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.251230] futex hash table entries: 1024 (order: 3, 32768 bytes)
[    0.251531] pinctrl core: initialized pinctrl subsystem
[    0.253959] NET: Registered protocol family 16
[    0.254794] Reboot with unknown events!
[    0.263224] sfax8serial 18300000.serial: could not find pctldev for node /pinctrl/uart0/uart0-txd, deferring probe
[    0.274619] clocksource: Switched to clocksource timer
[    0.277349] NET: Registered protocol family 2
[    0.278570] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    0.278641] TCP bind hash table entries: 1024 (order: 2, 20480 bytes)
[    0.278716] TCP: Hash tables configured (established 1024 bind 1024)
[    0.278946] UDP hash table entries: 256 (order: 1, 12288 bytes)
[    0.279029] UDP-Lite hash table entries: 256 (order: 1, 12288 bytes)
[    0.279507] NET: Registered protocol family 1
[    0.281567] Crashlog allocated RAM at address 0x1e00000
[    0.282143] workingset: timestamp_bits=30 max_order=14 bucket_order=0
[    0.289191] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.289231] jffs2: version 2.2 (ZLIB) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.294217] io scheduler noop registered
[    0.294256] io scheduler deadline registered
[    0.294834] io scheduler cfq registered (default)
[    0.294864] io scheduler mq-deadline registered
[    0.294875] io scheduler kyber registered
[    0.328503] cacheinfo: Unable to detect cache hierarchy for CPU 0
[    0.344351] brd: module loaded
[    0.345625] sfax8-spi 18202000.spi: sfax8_spi_probe...
[    0.347878] [WAV_FLASH]FOUND_BY_ENC_FLASH
[    0.347918] Wavlink Encryption System is unlocked!
[    0.347958] m25p80 spi2.0: found fm25q64, expected w25q128
[    0.347992] m25p80 spi2.0: fm25q64 (8192 Kbytes)
[    0.349147] 5 fixed-partitions partitions found on MTD device spi2.0
[    0.349182] Creating 5 MTD partitions on "spi2.0":
[    0.349215] 0x000000000000-0x000000020000 : "spl-loader"
[    0.350635] 0x000000020000-0x000000080000 : "u-boot"
[    0.351898] 0x000000080000-0x000000090000 : "u-boot-env"
[    0.353217] 0x000000090000-0x0000000a0000 : "factory"
[    0.354475] 0x0000000a0000-0x000000800000 : "firmware"
[    0.361377] random: fast init done
[    0.393615] 2 uimage-fw partitions found on MTD device firmware
[    0.393668] 0x0000000a0000-0x000000283763 : "kernel"
[    0.395229] 0x000000283763-0x000000800000 : "rootfs"
[    0.396449] mtd: device 6 (rootfs) set to be root filesystem
[    0.396821] 1 squashfs-split partitions found on MTD device rootfs
[    0.396864] 0x000000750000-0x000000800000 : "rootfs_data"
[    0.398279] sfax8-spi 18202000.spi: SFAx8 SPI Controller at 0x18202000 irq 21
[    0.401315] libphy: Fixed MDIO Bus: probed
[    0.904433] i8042: i8042 controller selftest timeout
[    0.907697] Netfilter messages via NETLINK v0.30.
[    0.908073] nf_conntrack version 0.5.0 (1024 buckets, 4096 max)
[    0.908479] nf_tables: (c) 2007-2009 Patrick McHardy <kaber@trash.net>
[    0.908509] nf_tables_compat: (c) 2012 Pablo Neira Ayuso <pablo@netfilter.org>
[    0.908619] xt_time: kernel timezone is -0000
[    0.909074] ip_tables: (C) 2000-2006 Netfilter Core Team
[    0.910882] NET: Registered protocol family 10
[    0.913861] Segment Routing with IPv6
[    0.914020] NET: Registered protocol family 17
[    0.914104] 8021q: 802.1Q VLAN Support v1.8
[    0.917292] 18300000.serial: ttyS0 at MMIO 0x18300000 (irq = 22, base_baud = 7812500) is a SFAX8 rev32
[    1.642384] console [ttyS0] enabled
[    1.647367] input: gpio-keys as /devices/platform/gpio-keys/input/input0
[    1.669499] VFS: Mounted root (squashfs filesystem) readonly on device 31:6.
[    1.677613] Freeing unused kernel memory: 324K
[    1.682095] This architecture does not have kernel memory protection.
[    2.489776] init: Console is alive
[    2.607267] random: crng init done
[    3.673958] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    3.886755] sfax8_factory_read_probe...
[    3.891125] macaddr is: 0X80 0X3F 0X5D 0X7D 0XFA 0XC8 
[    3.896627] sn is: 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 
[    3.905980] sn_flag is 0xFF
[    3.909055] hardware version flag is: 0XFF 0XFF 
[    3.913868] hardware version is: 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 
[    3.931439] model version flag is: 0XFF 0XFF 
[    3.936056] model version is: 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 
[    3.953332] Use default value [CN] because of can not find an vaild country ID: 0XFF 0XFF 
[    3.961680] countryID is: 0X43 0X4E 
[    3.965506] HW feature is 0xffffffff
[    3.969232] vender flag is: 0XFF 0XFF 
[    3.973162] vender is: 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 
[    3.982844] product key flag is: 0XFF 0XFF 
[    3.987279] product key is: 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 0XFF 
[    4.004384] login info flag is: 0XFF 0XFF 
[    4.008727] login info is 0XFFFFFFFF
[    4.012477] rom type flag is: 0XFF 0XFF 
[    4.016658] rom type is 0xffffffff
[    4.020212] get wifi version: 0X56 0X34 
[    4.027043] get gmac delay: 0X32 0X61 0X30 0X38 
[    4.031694] sf_factory_read_sysfs_register, parent :sfax8_factory_read
[    4.073279] sf_gmac: h/w version is 0x1037
[    4.077702] sf_gmac: request irq=18 ret=0
[    4.081781] sf_gmac: request pmt irq=19 ret=0
[    4.086489] libphy: Siflower MII Bus: probed
[    4.091068] [hnat notice]hnat probe success
[    4.095537] hnat dev name sf_hnat.0.auto
[    4.099484] sf gmac not phy config use switch
[    5.356889] end sf_trigger_eswitch_hwReset
[    5.361589] register new generic netlink family name COMMON_NL!
[    5.367817] sf generic netlink module init success,get family id 23!
[    5.374310] genl dev name sf_genl.2.auto
[    5.378360] eswitch probe success
[    5.416765] register new generic netlink family name DPS_NL!
[    5.422565] init dps family with id 24!
[    5.426503] sf gmac get switch model 5
[    5.434076] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    5.449569] init: - preinit -
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    8.390368] mount_root: loading kmods from internal overlay
[    8.423582] kmodloader: loading kernel modules from //etc/modules-boot.d/*
[    8.432439] kmodloader: done loading kernel modules from //etc/modules-boot.d/*
[    9.016497] jffs2: notice: (96) jffs2_build_xattr_subsystem: complete building xattr subsystem, 10 of xdatum (0 unchecked, 8 orphan) and 46 of xref (8 dead, 13 orphan) found.
[    9.033712] block: attempting to load /tmp/jffs_cfg/upper/etc/config/fstab
[    9.051186] block: extroot: not configured
[    9.241311] jffs2: notice: (94) jffs2_build_xattr_subsystem: complete building xattr subsystem, 10 of xdatum (0 unchecked, 8 orphan) and 46 of xref (8 dead, 13 orphan) found.
[    9.667906] block: attempting to load /tmp/jffs_cfg/upper/etc/config/fstab
[    9.684743] block: extroot: not configured
[    9.727365] mount_root: switching to jffs2 overlay
[    9.757249] overlayfs: upper fs does not support tmpfile.
[    9.774006] urandom-seed: Seed file not found (/etc/urandom.seed)
[    9.928351] startcore init fill all memory!
[    9.969899] rf access base address : b1c00000
[    9.974298] sf_wifi_rf_os_resources_get:
[    9.978286]  priv->base : b1c00000
[    9.981702]  priv->irq : 27
[    9.984710] dual antenna calibration is on
[    9.988819] priv->cali_table_version = 2---V4 dual_antenna_calibrate = 1  
[   10.186092] get LB1_EXTERNAL_PA_CONF_IN_IDLE==f0
[   10.190749] get LB1_EXTERNAL_PA_CONF_IN_RX==f4
[   10.195321] get LB1_EXTERNAL_PA_CONF_IN_TX==f4
[   10.199770] get LB1_EXTERNAL_PA_CONF_IN_PA==f3
[   10.204217] get LB2_EXTERNAL_PA_CONF_IN_IDLE==f0
[   10.208871] get LB2_EXTERNAL_PA_CONF_IN_RX==f4
[   10.213322] get LB2_EXTERNAL_PA_CONF_IN_TX==f4
[   10.217805] get LB2_EXTERNAL_PA_CONF_IN_PA==f3
[   10.222256] get HB1_EXTERNAL_PA_CONF_IN_IDLE==f0
[   10.226928] get HB1_EXTERNAL_PA_CONF_IN_RX==f4
[   10.231381] get HB1_EXTERNAL_PA_CONF_IN_TX==f4
[   10.235867] get HB1_EXTERNAL_PA_CONF_IN_PA==f1
[   10.240321] get HB2_EXTERNAL_PA_CONF_IN_IDLE==f0
[   10.244996] get HB2_EXTERNAL_PA_CONF_IN_RX==f4
[   10.249458] get HB2_EXTERNAL_PA_CONF_IN_TX==f4
[   10.253914] get HB2_EXTERNAL_PA_CONF_IN_PA==f1
[   10.258452] get HB_RX_STEP2_VALUE==f4
[   10.262130] get HB_RX_STEP2_DELAY==c8
[   10.265836] get HB_TX_STEP2_DELAY==c8
[   10.269533] gpio 0 level is 0, hb_ex_pa_exist 1, lb_ex_pa_exist 0
[   10.382355] Now copy rf_pmem.bin firmware with size 77880, @ = 0x4002
[   10.402489] Now copy rf_default_reg.bin default reg with size 65812
[   10.434663] XO config value : 7
[   10.438397] get TRX_PATH_CFG==ff
[   10.441659] rf_bootup
[   10.443934] ml_apb_send_0_params_cmd command : 0x8010, cmd_base : 0x3240, rrq : 1
[   10.451600] command 0x8010 get a repsonse with args : 4
[   10.456864] rf hw version : 0x50c0
[   10.460264] rf sw version : 0x210c
[   10.463661] value : 0x1
[   10.466135] command header： 8368
[   10.469544] req DW1=0xf0f0 DW2=0xf4f4 DW3=0xf4f4 DW4=0xf1f1 DW5=0xf0f0 DW6=0xf4f4 DW7=0xf4f4 DW8=0xf3f3 DW9=0x0
[   10.479661] command 0x8368 get a repsonse with args : 1
[   10.484936] ml_apb_send_1_params_cmd, rrq = 1, cmd_base : 0x3240, cmd = 0x8101, args0 = 0xff
[   10.493484] command 0x8101 get a repsonse with args : 1
[   10.498783] xo_value_conf :0x7
[   10.501847] ml_apb_send_1_params_cmd, rrq = 1, cmd_base : 0x3240, cmd = 0x8111, args0 = 0x7
[   10.510326] command 0x8111 get a repsonse with args : 1
[   10.515581] switch to OPERATING mode
[   10.519159] ml_apb_send_0_params_cmd command : 0x8090, cmd_base : 0x3240, rrq : 1
[   10.929925] command 0x8090 get a repsonse with args : 1
[   10.964613] ml_apb_send_0_params_cmd command : 0x8070, cmd_base : 0x3240, rrq : 1
[   10.972207] command 0x8070 get a repsonse with args : 2
[   10.977510] ml_apb_send_2_params_cmd, rrq = 1, cmd_base : 0x3240, cmd = 0x8042, args0 = 0x30, args1 = 0x1
[   10.987229] command 0x8042 get a repsonse with args : 1
[   10.992455] property_id 48 property_value 1
[   10.996672] ml_apb_send_2_params_cmd, rrq = 1, cmd_base : 0x3240, cmd = 0x8042, args0 = 0x2d, args1 = 0x10
[   11.006455] command 0x8042 get a repsonse with args : 1
[   11.011679] property_id 45 property_value 16
[   11.015982] ml_apb_send_2_params_cmd, rrq = 1, cmd_base : 0x3240, cmd = 0x8042, args0 = 0x2c, args1 = 0xa
[   11.025702] command 0x8042 get a repsonse with args : 1
[   11.030934] property_id 44 property_value 10
[   11.035271] ml_apb_send_2_params_cmd, rrq = 1, cmd_base : 0x3240, cmd = 0x8042, args0 = 0x1b, args1 = 0x32
[   11.045058] command 0x8042 get a repsonse with args : 1
[   11.050282] property_id 27 property_value 50
[   11.054585] ml_apb_send_2_params_cmd, rrq = 1, cmd_base : 0x3240, cmd = 0x8042, args0 = 0x31, args1 = 0xc8
[   11.064346] command 0x8042 get a repsonse with args : 1
[   11.069596] property_id 49 property_value 200
[   11.073954] ml_apb_send_2_params_cmd, rrq = 1, cmd_base : 0x3240, cmd = 0x8042, args0 = 0x33, args1 = 0xf4f4
[   11.083910] command 0x8042 get a repsonse with args : 1
[   11.089188] property_id 51 property_value 62708
[   11.093731] ml_apb_send_2_params_cmd, rrq = 1, cmd_base : 0x3240, cmd = 0x8042, args0 = 0x32, args1 = 0xc8
[   11.103550] command 0x8042 get a repsonse with args : 1
[   11.108804] property_id 50 property_value 200
[   11.113161] rf mod param thermal_on 1 
[   11.116944] read cooling temp(0x1e0) from factory
[   11.116953] set thermal_state : 11
[   11.121655] dual thermal 1
[   11.127814] **************************************************************sfax8_thermal_sensor_register
[   11.129907] ml_apb_send_2_params_cmd, rrq = 1, cmd_base : 0x3240, cmd = 0x8042, args0 = 0x2c, args1 = 0x7
[   11.149176] command 0x8042 get a repsonse with args : 1
[   11.154410] property_id 44 property_value 7
[   11.158643] ml_apb_send_2_params_cmd, rrq = 1, cmd_base : 0x3240, cmd = 0x8052, args0 = 0x2c, args1 = 0x1
[   11.168342] command 0x8052 get a repsonse with args : 2
[   11.173567] set base gain 7 state = 1
[   11.177495] ml_apb_send_2_params_cmd, rrq = 1, cmd_base : 0x3240, cmd = 0x8052, args0 = 0x2c, args1 = 0x1
[   11.187209] command 0x8052 get a repsonse with args : 2
[   11.192437] ml_apb_send_2_params_cmd, rrq = 1, cmd_base : 0x3240, cmd = 0x8042, args0 = 0x2c, args1 = 0xa
[   11.202132] command 0x8042 get a repsonse with args : 1
[   11.207405] property_id 44 property_value 10
[   11.211684] ml_apb_send_2_params_cmd, rrq = 1, cmd_base : 0x3240, cmd = 0x8052, args0 = 0x2c, args1 = 0x1
[   11.221391] command 0x8052 get a repsonse with args : 2
[   11.226670] set base gain 10 state = 7
[   11.231061] sf_wifi_rf_sysfs_register, parent :aetnensis
[   12.267608] Loading modules backported from Linux version v4.19.7-0-g61c68f2a2af0
[   12.275181] Backport generated by backports.git v4.19.7-1-0-g148b072d
[   12.335079] sf16a18_lb_fmac: unknown parameter 'independent_antenna_control' ignored
[   12.343712] siwifi v - build: franklin Mar 30 2017 11:10:15 - svnUnversioned directory
[   12.352217] Now band 2.4G
[   12.354952] load_task, path : sf1688_lb_fmac.bin, task_id : 0
[   12.366559] node->entry_addr=1f00000 node=82d5d700
[   12.379365] task id=0 state=0
[   12.382389] siwifi_platform_init, priv->base : b1000000
[   12.388623] get wifi address from factory
[   12.392763] info: gpio-0 is got successfully!<<<<<<<<<<<<<<<<<<<<<<<
[   12.399882] info: siwifi_led_init successful!<<<<<<<<<<<<<<<<<<<<<<<
[   12.407192] the default platform clk rate is 375000000
[   12.412789] txpower calibration table use factory info
[   12.458860] band 0: wifi txpower table version 4, flag 18, normal list 83409000, sleepmode list 83409e00, low list 83409200, high list   (null)
[   12.471817] normal second list 83408200, sleepmode second list 83408600, low second list 83408400
[   12.484714] lb registering.......
[   12.488064] find a empty client seat : 0
[   12.493219] Now copy ldpcram.bin firmware, @ = 0xb1109000
[   12.498773] size=980, is_lb=1
[   12.501915] load ldpc cost 0 cnt loop
[   12.505641] lmac_glue_start(0)
[   12.508699] start_task, 0
[   12.511318] task entry_addr=0x1f00000
[   12.515015] start aresetn 0 por_resetn 0 
[   12.519025] wait lmac init(0)>>>>>>>>>>>>>>>>>>>>>>>
[   12.525136] lmac init complete(0)
[   12.528478] lmac[0] v6.0.0.0 - build: davy Fri, 06 Nov 2020 15:05:54 +0800 band: 0
[   12.536145] wait lmac over(0)<<<<<<<<<<<<<<<<<<<<<<<
[   12.541115] successfully turn on platform 0!
[   12.547528] ieee80211 phy0: PHY features: [NSS=2][CHBW=40][LDPC]
[   12.553559] ieee80211 phy0: FW features: [BCN][AUTOBCN][HWSCAN][CMON][MROLE][RADAR][PS][UAPSD][DPSM][AMPDU][AMSDU][CHNL_CTXT][REORD][UMAC][WAPI][MFP][LITE_MEM]
[   12.567867] tx headroom : 252, tx amsdu headroom : 50, rx headroom : 182, rx pd offset 252
[   12.576676] rx_bufsz - 2560, rx_pd_offset - 252
[   12.581689] radar set region 0
[   12.585796] siwifi_hw->phy_config.digtable[0]:30303030
[   12.590973] siwifi_hw->phy_config.digtable[1]:2d2d2d2d
[   12.596304] siwifi_hw->phy_config.digtable[2]:30303030
[   12.601451] siwifi_hw->phy_config.digtable[3]:2d2d2d2d
[   12.606641] siwifi_hw->phy_config.digtable[4]:30303030
[   12.611789] siwifi_hw->phy_config.digtable[5]:2d2d2d2d
[   12.616968] siwifi_hw->phy_config.digtable_max[0]:7f504434
[   12.622467] siwifi_hw->phy_config.digtable_max[1]:6c4c4030
[   12.628000] siwifi_hw->phy_config.digtable_max[2]:7f504434
[   12.633501] siwifi_hw->phy_config.digtable_max[3]:6c4c4030
[   12.639029] siwifi_hw->phy_config.digtable_max[4]:7f504434
[   12.644531] siwifi_hw->phy_config.digtable_max[5]:6c4c4030
[   12.650065] siwifi_hw->phy_config.digtable_max[6]:0
[   12.654985] siwifi_hw->phy_config.digtable[6]:1
[   12.659725] siwifi_parse_txpower_gain_table_configfile: lb_txpower_table.ini not exsist, use default file.
[   12.669461] [POWER_TABLE_NAME] siwifi_parse_txpower_gain_table_configfile 460 default_lb_txpower_table.ini
[   12.682197] found hnat device to add
[   12.685914] [hnat notice]add wifi dev index 7 ndev831f0000
[   12.691429] ieee80211 phy0: New interface create wlan0
[   12.725939] sf16a18_hb_fmac: unknown parameter 'independent_antenna_control' ignored
[   12.734704] siwifi v - build: franklin Mar 30 2017 11:10:15 - svnUnversioned directory
[   12.743146] Now band 5G
[   12.745659] load_task, path : sf1688_hb_fmac.bin, task_id : 1
[   12.951910] node->entry_addr=1f60000 node=8288a200
[   12.964853] task id=1 state=0
[   12.967874] siwifi_platform_init, priv->base : b7800000
[   12.973795] get wifi address from factory
[   12.978124] info: gpio-0 is got successfully!<<<<<<<<<<<<<<<<<<<<<<<
[   12.984505] info ret = -16, request failed but keep setting!<<<<<<<<<<<<<<<<<<<<<<<
[   12.992832] info: siwifi_led_init successful!<<<<<<<<<<<<<<<<<<<<<<<
[   13.000391] the default platform clk rate is 375000000
[   13.005818] txpower calibration table use factory info
[   13.013634] band 1: wifi txpower table version 4, flag 22, normal list 83c0e800, sleepmode list 83c0f000, low list 83c0f800, high list   (null)
[   13.026598] normal second list 83c0d800, sleepmode second list 83c0d000, low second list 83c0c800
[   13.039392] hb registering.......
[   13.042726] find a empty client seat : 1
[   13.047869] Now copy ldpcram.bin firmware, @ = 0xb7909000
[   13.053295] size=1500, is_lb=0
[   13.056756] load ldpc cost 0 cnt loop
[   13.060432] lmac_glue_start(1)
[   13.063485] start_task, 1
[   13.066139] task entry_addr=0x1f60000
[   13.069804] start aresetn 0 por_resetn 0 
[   13.073811] wait lmac init(1)>>>>>>>>>>>>>>>>>>>>>>>
[   13.079147] lmac init complete(1)
[   13.079178] wait lmac over(1)<<<<<<<<<<<<<<<<<<<<<<<
[   13.082488] lmac[1] v6.0.0.0 - build: davy Fri, 06 Nov 2020 15:05:54 +0800 band: 1
[   13.087486] successfully turn on platform 1!
[   13.101041] ieee80211 phy1: PHY features: [NSS=2][CHBW=80][LDPC]
[   13.107127] ieee80211 phy1: FW features: [BCN][AUTOBCN][HWSCAN][CMON][MROLE][RADAR][PS][UAPSD][DPSM][AMPDU][AMSDU][CHNL_CTXT][REORD][UMAC][VHT][WAPI][MFP][LITE_MEM]
[   13.121907] tx headroom : 252, tx amsdu headroom : 50, rx headroom : 182, rx pd offset 252
[   13.131106] rx_bufsz - 2560, rx_pd_offset - 252
[   13.136338] radar set region 0
[   13.140393] siwifi_hw->phy_config.digtable[0]:20202020
[   13.145798] siwifi_hw->phy_config.digtable[1]:1e1e1e1e
[   13.150949] siwifi_hw->phy_config.digtable[2]:20202020
[   13.156138] siwifi_hw->phy_config.digtable[3]:1e1e1e1e
[   13.161282] siwifi_hw->phy_config.digtable[4]:20202020
[   13.166458] siwifi_hw->phy_config.digtable[5]:1e1e1e1e
[   13.171606] siwifi_hw->phy_config.digtable_max[0]:20202020
[   13.177133] siwifi_hw->phy_config.digtable_max[1]:20202020
[   13.182629] siwifi_hw->phy_config.digtable_max[2]:20202020
[   13.188155] siwifi_hw->phy_config.digtable_max[3]:20202020
[   13.193653] siwifi_hw->phy_config.digtable_max[4]:20202020
[   13.199197] siwifi_hw->phy_config.digtable_max[5]:20202020
[   13.204737] siwifi_hw->phy_config.digtable_max[6]:0
[   13.209626] siwifi_hw->phy_config.digtable[6]:1
[   13.214387] siwifi_parse_txpower_gain_table_configfile: hb_txpower_table_expa.ini not exsist, use default file.
[   13.224619] [POWER_TABLE_NAME] siwifi_parse_txpower_gain_table_configfile 448 default_hb_txpower_table_expa_low_power.ini
[   13.238914] found hnat device to add
[   13.242541] [hnat notice]add wifi dev index 6 ndev82b02000
[   13.248140] ieee80211 phy1: New interface create wlan1
[   13.265129] procd: - early -
[   14.206392] procd: - ubus -
[   14.646874] procd: - init -
Please press Enter to activate this console.
[   15.130063] kmodloader: loading kernel modules from /etc/modules.d/*
[   15.230068] ip6_tables: (C) 2000-2006 Netfilter Core Team
[   15.276184] ip_set: protocol 6
[   15.331028] u32 classifier                                                                                                                                                                    
[   15.333783]     input device check on                                                                                                                                                         
[   15.337553]     Actions configured                                                                                                                                                            
[   15.343904] Mirror/redirect action on                                                                                                                                                         
[   15.396812] Ebtables v2.0 registered                                                                                                                                                          
[   15.403068] ctnetlink v0.93: registering with nfnetlink.                                                                                                                                      
[   15.435690] PPP generic driver version 2.4.2                                                                                                                                                  
[   15.442149] NET: Registered protocol family 24                                                                                                                                                
[   15.453212] kmodloader: done loading kernel modules from /etc/modules.d/*                                                                                                                     
crond[402]: crond (busybox 1.29.3) started, log level 8                                                                                                                                          
[   32.289830] [hnat info] ifname br-lan, index 0  is wan 0                                                                                                                                      
[   32.372656] [hnat info] ifname eth0.2, index 0  is wan 1                                                                                                                                      
[   32.437493] [hnat info] ifname pppoe-wan, index 7  is wan 1                                                                                                                                   
[   41.999687] gmac open success                                                                                                                                                                 
[   42.012856] br-lan: port 1(eth0.1) entered blocking state                                                                                                                                     
[   42.018415] br-lan: port 1(eth0.1) entered disabled state                                                                                                                                     
[   42.025861] device eth0.1 entered promiscuous mode                                                                                                                                            
[   42.030782] device eth0 entered promiscuous mode                                                                                                                                              
[   42.039999] br-lan: port 1(eth0.1) entered blocking state                                                                                                                                     
[   42.045597] br-lan: port 1(eth0.1) entered forwarding state
[   42.052959] [hnat info]add lan ip c0a81401 pf 24  index 0 name br-lan
[   42.805648] lb-fmac 11000000.wifi-lb wlan0: Remove Interface
[   42.811437] found hnat device to del
[   42.896773] free src filter hash table
[   42.900666] lb-fmac 11000000.wifi-lb wlan0 (unregistering): Remove Interface Over
[   42.976861] hb-fmac 17800000.wifi-hb wlan1: Remove Interface
[   42.982684] found hnat device to del
[   43.048924] free src filter hash table
[   43.052887] hb-fmac 17800000.wifi-hb wlan1 (unregistering): Remove Interface Over
[   43.518806] radar set region 1
[   43.524330] radar set region 1
[   44.485151] =========================================
[   44.490294] ==============WIN_IGD START==============
[   44.495609] =========================================
[   44.500796] WIN_IGD: WAN_IF: eth0.2 LAN_IF: br-lan GUEST_IF: br-guest
[   44.509627] end ts module init
[   45.393365] found hnat device to add
[   45.397238] [hnat notice]add wifi dev index 7 ndev82b04000

wrtwf · January 1, 2025, 11:17am

There are also several shells available. I did some poking in the first (lowest level) instance:

winstar # help
?       - alias for 'help'
base    - print or set address offset
bdinfo  - print Board Info structure
boot    - boot default, i.e., run 'bootcmd'
bootd   - boot default, i.e., run 'bootcmd'
bootelf - Boot from an ELF image in memory
bootm   - boot application image from memory
bootp   - boot image via network using BOOTP/TFTP protocol
bootvx  - Boot vxWorks from an ELF image
btn_httpd_detect- check pmu buttom to run httpd
cmp     - memory compare
coninfo - print console devices and information
cp      - memory copy
crc32   - checksum calculation
dhcp    - boot image via network using DHCP/TFTP protocol
dm      - Driver model low level access
echo    - echo args to console
editenv - edit environment variable
env     - environment handling commands
exit    - exit script
false   - do nothing, unsuccessfully
fdt     - flattened device tree utility commands
go      - start application at address 'addr'
help    - print command description/usage
httpd   - start www server for firmware recovery with [localAddress]

iminfo  - print header information for application image
imxtract- extract a part of a multi-image
itest   - return true/false on integer compare
loop    - infinite loop on address range
lzmadec - lzma uncompress a memory region
md      - memory display
mm      - memory modify (auto-incrementing address)
mw      - memory write (fill)
nm      - memory modify (constant address)
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
reset   - Perform RESET of the CPU
rhreset - Rehold all module resets to save power.
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv  - set environment variables
sf      - SPI flash sub-system
showvar - print local hushshell variables
sleep   - delay execution for some time
source  - run script from memory
spld    - update spl from device
test    - minimal test like /bin/sh
tftpboot- boot image via network using TFTP protocol
true    - do nothing, successfully
version - print monitor, compiler and linker version
winstar # bdinfo 
boot_params = 0x83EC91B0
memstart    = 0x80000000
memsize     = 0x04000000
flashstart  = 0x00000000
flashsize   = 0x00000000
flashoffset = 0x00000000
ethaddr     = (not set)
ip_addr     = 192.168.10.101
baudrate    = 115200 bps
relocaddr   = 0x83FB6000
reloc off   = 0xE3FB6000
winstar # printenv 
baudrate=115200
bootcmd=sf probe 0 33000000;sf read 0x81000000 0xa0000 0x700000;bootm
bootdelay=2
ethact=sf_eth1
fdtcontroladdr=83ea479c
imagename=firmware.bin
ipaddr=192.168.10.101
netretry=yes
preboot=btn_httpd_detect 192.168.10.1
serverip=192.168.10.100
stderr=serial@8300000
stdin=serial@8300000
stdout=serial@8300000
tftpburn=yes
tne=0

Environment size: 372/65532 bytes
winstar # version 

U-Boot 2016.07-rc2 (Aug 28 2024 - 02:53:35 +0000)
mipsel-openwrt-linux-uclibc-gcc (OpenWrt/Linaro GCC 4.8-2014.04 unknown) 4.8.3
GNU ld (GNU Binutils) 2.24.0

evs · January 3, 2025, 3:43am

Cool!

So Ethernet support only then I guess?

That first prompt is bootloader/u-boot which I guess means you can try to boot your own stuff which is a good start.